5 ms·

And WordPress itself is NOT insecure. It is in fact the most secure CMS you can find out there. The issue is that its simplicity and easy installation, brought

by rmdoss 11y ago

And WordPress itself is NOT insecure. It is in fact the most secure CMS you can find out there. The issue is that its simplicity and easy installation, brought a lot of non-technical people to use it and develop for it. So you get a lot of bad written themes and plugins that lead to all sort of security issues. On the other hand, Drupal and Joomla, all had SQL injections on their core discovered lately: https://www.drupal.org/SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 https://blog.sucuri.net/2015/10/joomla-3-4-5-released-fixing-a-serious-sql-injection-vulnerability.html https://blog.sucuri.net/2015/10/joomla-3-4-5-released-fixing...

jqm 11y ago
But it does get an inordinate amount of attention from people looking to crack it. At least according to my server logs. So sure... if everything is locked down and up to date and no shaky plugins installed no problem. On the other hand, one careless slip up...
- pavs 11y ago
  > On the other hand, one careless slip up... And how is it not the same for any other server side software? Most of the WP security issue is related to user not knowing what they are doing or third party plugin/theme. Wordpress vanialla itself is not anymore insecure than other popular CMS or simialar software out there. From my own personal experince from doing at least 70-80 WP installs in different configurations and have never experienced any security issues in over 10 years. Thats doesnt mean its the norm. Its just that if you are going to play with a highly customizable and powerful piece of server side software and if you dont know what you are doing then you are going to screw shit up.
  - jqm 11y ago
    Other server side software doesn't get nearly the same number of attacks. At least according to my server logs. Plus, other server side software doesn't let button clickers get into trouble as easily.
jonesb6 11y ago
I learned a lot about security on the web by poking around wordpress sites in school. While I believe what you're saying is true it's hard to believe that the perception alone of wordpress's 'hackability' doesn't make it much more of a security risk. "Oh they run wordpress? I can probably get into that." "Runs wordpress vulnerability scanner script" "Oh hey look ~wp-config.php!"
- keithpeter 11y ago
  Yup: so I moved my low traffic vanity site back to static html when I worked out that I was spending more time reinstalling WordPress because of security advisories than actually writing anything. As the chap who runs pinboard put it [1] people like me should not be running web applications like WordPress on live server space. So I ran WordPress locally and harvested the html pages. Then realised that I was using a poky little text area to write when I could just use a text editor... [1] http://idlewords.com/2009/09/how_to_not_get_your_blog_hacked.htm http://idlewords.com/2009/09/how_to_not_get_your_blog_hacked...
hannob 11y ago
I agree that Wordpress is probably the most secure major CMS out there, but it's unfortunately still not good. It had a whole bunch of XSS issues lately. XSS should be a thing of the past if people would implement Content Security Policy. I'm not aware that Wordpress is working on this. This is hardly defensible. On the positive side I think their automatic update mechanism helps a lot and it's a pity other major CMSes don't have that.

by rmdoss 11y ago

jqm 11y ago

But it does get an inordinate amount of attention from people looking to crack it. At least according to my server logs. So sure... if everything is locked down and up to date and no shaky plugins installed no problem. On the other hand, one careless slip up...

pavs 11y ago
> On the other hand, one careless slip up... And how is it not the same for any other server side software? Most of the WP security issue is related to user not knowing what they are doing or third party plugin/theme. Wordpress vanialla itself is not anymore insecure than other popular CMS or simialar software out there. From my own personal experince from doing at least 70-80 WP installs in different configurations and have never experienced any security issues in over 10 years. Thats doesnt mean its the norm. Its just that if you are going to play with a highly customizable and powerful piece of server side software and if you dont know what you are doing then you are going to screw shit up.
- jqm 11y ago
  Other server side software doesn't get nearly the same number of attacks. At least according to my server logs. Plus, other server side software doesn't let button clickers get into trouble as easily.

jonesb6 11y ago

I learned a lot about security on the web by poking around wordpress sites in school. While I believe what you're saying is true it's hard to believe that the perception alone of wordpress's 'hackability' doesn't make it much more of a security risk. "Oh they run wordpress? I can probably get into that." "Runs wordpress vulnerability scanner script" "Oh hey look ~wp-config.php!"

keithpeter 11y ago
Yup: so I moved my low traffic vanity site back to static html when I worked out that I was spending more time reinstalling WordPress because of security advisories than actually writing anything. As the chap who runs pinboard put it [1] people like me should not be running web applications like WordPress on live server space. So I ran WordPress locally and harvested the html pages. Then realised that I was using a poky little text area to write when I could just use a text editor... [1] http://idlewords.com/2009/09/how_to_not_get_your_blog_hacked.htm http://idlewords.com/2009/09/how_to_not_get_your_blog_hacked...

hannob 11y ago

I agree that Wordpress is probably the most secure major CMS out there, but it's unfortunately still not good. It had a whole bunch of XSS issues lately. XSS should be a thing of the past if people would implement Content Security Policy. I'm not aware that Wordpress is working on this. This is hardly defensible. On the positive side I think their automatic update mechanism helps a lot and it's a pity other major CMSes don't have that.